CVE-2026-30853: calibre has a Path Traversal Leading to Arbitrary File Write
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30853?
CVE-2026-30853 has been classified as a high severity vulnerability due to its potential impact on file security.
How do I fix CVE-2026-30853?
To fix CVE-2026-30853, update to calibre version 9.5.0 or later, which addresses the path traversal vulnerability.
What does CVE-2026-30853 affect?
CVE-2026-30853 affects versions of calibre prior to 9.5.0, specifically the RocketBook (.rb) input plugin.
What is a path traversal vulnerability in the context of CVE-2026-30853?
A path traversal vulnerability like CVE-2026-30853 allows attackers to manipulate file paths to access unauthorized files on the system.
Can CVE-2026-30853 lead to arbitrary file writes?
Yes, CVE-2026-30853 allows an attacker to write arbitrary files to the filesystem, posing serious security risks.